Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-9789

Support server advertised kerberos principals

    XMLWordPrintableJSON

Details

    • New Feature
    • Status: Closed
    • Critical
    • Resolution: Fixed
    • 2.0.0-alpha, 3.0.0-alpha1
    • 2.1.1-beta
    • ipc, security
    • None
    • Reviewed

    Description

      The RPC client currently constructs the kerberos principal based on the a config value, usually with an _HOST substitution. This means the service principal must match the hostname the client is using to connect. This causes problems:

      • Prevents using HA with IP failover when the servers have distinct principals from the failover hostname
      • Prevents clients from being able to access a service bound to multiple interfaces. Only the interface that matches the server's principal may be used.

      The client should be able to use the SASL advertised principal (HADOOP-9698), with appropriate safeguards, to acquire the correct service ticket.

      Attachments

        1. HADOOP-9789.2.patch
          0.9 kB
          Daryn Sharp
        2. HADOOP-9789.patch
          16 kB
          Daryn Sharp
        3. HADOOP-9789.patch
          13 kB
          Daryn Sharp
        4. hadoop-ojoshi-datanode-HW10351.local.log
          344 kB
          Omkar Vinit Joshi
        5. hadoop-ojoshi-namenode-HW10351.local.log
          194 kB
          Omkar Vinit Joshi

        Issue Links

          Activity

            People

              daryn Daryn Sharp
              daryn Daryn Sharp
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: